Hi Nathan, I did try to reproduce your issue but with no luck. Can you say what capturing method are you using (libpcap, NetFlow, sFlow, or ..?). Is it that all data is mistakenly placed into the previous timeslot or it is possible you might be effectively receiving only bits of data belonging to the previous timeslot and bulk of the data belongs to the current timeslot? I can imagine this can happen a lot with NetFlow if nfacctd_time_new is set to false, which is default, or with libpcap and/or sFlow in case buffering is enabled. Let me know.
Cheers, Paolo On Fri, Oct 04, 2013 at 12:45:49AM +0000, Nathan Kennedy wrote: > Hi all, > > I've managed to compile with rabbitmq enabled, and publish data to an > exchange - works great! > > I have noticed some strange behaviour with the stamp_inserted value. > When amqp_history is set, the stamp_inserted value is being set to the > previous slot rather than the current slot. > For example, stamp_updated may be 2013-10-04 00:37:11 but stamp_inserted is > 2013-10-04 00:30:00. > > My config for this aggregation is as follows: > > ! 5 minutely IP to IP > aggregate[5m_ipip]: src_host, dst_host > amqp_routing_key[5m_ipip]: 5m_ipip > amqp_history[5m_ipip]: 5m > amqp_time_roundoff[5m_ipip]: m > amqp_refresh_time[5m_ipip]: 10 > > I managed to get the expected results by switching lines 194 and 195 of > amqp_plugin.c, but would like to confirm that this is the correct fix and > that it won't affect anything else? > > Thanks again! > Nathan. > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
